Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

agentcloud

v1.0.0

AgentCloud(AI Agent 云存储)— 一键注册 Agent,上传/下载文件,创建分享链接,查询用量。支持 Hermes Agent 和 OpenClaw 用户直接使用。

0· 53·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jiangzh0202/agentcloud.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "agentcloud" (jiangzh0202/agentcloud) from ClawHub.
Skill page: https://clawhub.ai/jiangzh0202/agentcloud
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install agentcloud

ClawHub CLI

Package manager switcher

npx clawhub@latest install agentcloud
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description describe cloud file storage and the code and SKILL.md implement exactly that (register agents, upload/download/share files via https://api.traceclaw.cn). Required capabilities in the package align with the stated purpose.
Instruction Scope
SKILL.md and the helper script include examples that perform agent registration (no auth), upload/download, and creation of public share links. The OpenClaw example shows an automatic register call using context.agent.name and storing the returned API key into agent memory (context.memory.set). That means an agent could automatically send identifying/context data to the external service and persist the API key in agent memory — behavior that is within purpose but increases data-exfiltration/privacy surface.
Install Mechanism
No install spec; skill is instruction-only with an optional helper script. The included Python script is straightforward and depends only on requests. No remote installers or obscure download URLs were used.
Credentials
The skill expects an API key (AGENTCLOUD_KEY) and offers to save it in plaintext to ~/.agentcloud/config.json and into agent memory. Requesting/storing a service API key is proportional to file-storage functionality, but storing secrets in plaintext on disk and in agent memory increases risk if the environment or agent memory is shared or untrusted.
Persistence & Privilege
always:false and no elevated platform privileges. The helper script writes its own config to ~/.agentcloud/config.json (normal for a CLI) and SKILL.md instructs copying itself into auto-discovery directories so agents can find it. Auto-discovery combined with the OpenClaw example that auto-registers could cause an agent to autonomously register and leak identifying info/API keys unless the user configures otherwise.
What to consider before installing
This skill implements an external cloud storage service (api.traceclaw.cn). Before installing or using it, consider: 1) Trust the service and its operator? The package has no homepage/maintainer info; verify the domain and maintainer. 2) Data exposure: uploads and automatic registration will send files and agent identifiers to an external server — do not upload sensitive files. 3) Secrets handling: the script saves API keys in plaintext at ~/.agentcloud/config.json and may place the key into agent memory (context.memory), which other skills or processes might access. Prefer ephemeral keys or set AGENTCLOUD_KEY only when needed; secure the config file permissions. 4) Auto-discovery risk: copying SKILL.md into global skill dirs can let agents discover and potentially run registration automatically; keep installation local and review/modify the OpenClaw example before use. 5) Test in a sandbox first and inspect network traffic (which endpoints are called) and the saved config. If you need to proceed safely: obtain service provenance (homepage, maintainers, privacy policy), audit the script, and avoid using it for sensitive or regulated data.

Like a lobster shell, security has layers — review code before you run it.

agentcloudvk97ar7z4ftrgm5eqdvyckzmb9s85mw4wlatestvk97ar7z4ftrgm5eqdvyckzmb9s85mw4w
53downloads
0stars
1versions
Updated 23h ago
v1.0.0
MIT-0

AgentCloud Skill

为 AI Agent 打造的云存储服务。让你的 Agent 拥有专属文件存储空间,支持跨 Agent 文件传输和分享。

快速开始

一键注册 Agent(无需手机/邮箱,无需先注册人类账号)

只需一个命令,Agent 就能获得专属存储空间:

curl -X POST https://api.traceclaw.cn/api/v1/agents/register/open \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent"}'

# 返回示例
# {
#   "agent_id": "agt_xxxxx",
#   "api_key": "avk_yyyyy",   # ← 保存好!只返回一次
#   "name": "my-agent",
#   "plan": "free",
#   "total_storage_mb": 30
# }

⚠️ api_key 只返回一次,请妥善保存。如果丢失,可在 Dashboard 重置。

设置 API Key

# 保存到环境变量(推荐)
export AGENTCLOUD_KEY="avk_yyyyy"

# 或直接写在请求头中
# X-Agent-Key: avk_yyyyy

API 概览

所有请求都通过 https://api.traceclaw.cn/api/v1 访问。

方法路径认证说明
POST/agents/register/open无(开放注册,限频3次/小时/IP)注册新 Agent
GET/agents/meX-Agent-Key查询本 Agent 信息
POST/agents/{id}/reset-keyX-Agent-Key重置 API Key
DELETE/agents/{id}X-Agent-Key删除 Agent
POST/files/uploadX-Agent-Key上传文件
GET/files/download/{id}X-Agent-Key下载文件
GET/filesX-Agent-Key文件列表
DELETE/files/{id}X-Agent-Key删除文件
POST/files/{id}/shareX-Agent-Key创建分享链接
GET/files/shared/{token}无需认证通过分享链接下载

认证方式:Agent 使用 X-Agent-Key 请求头,值为注册时获得的 avk_xxx API Key。

Python 使用示例

安装依赖

pip install requests

注册 Agent

import requests

BASE = "https://api.traceclaw.cn/api/v1"

# 注册(无需任何认证)
r = requests.post(f"{BASE}/agents/register/open", json={"name": "my-agent"})
data = r.json()

api_key = data["api_key"]  # 保存好!
agent_id = data["agent_id"]
print(f"注册成功!Agent ID: {agent_id}")

上传文件

API_KEY = "avk_xxxxx"  # 注册时获得的 Key

with open("report.pdf", "rb") as f:
    r = requests.post(
        f"{BASE}/files/upload",
        files={"file": ("report.pdf", f, "application/pdf")},
        headers={"X-Agent-Key": API_KEY}
    )
file_id = r.json()["file_id"]
print(f"上传成功!File ID: {file_id}")

下载文件

r = requests.get(
    f"{BASE}/files/download/{file_id}",
    headers={"X-Agent-Key": API_KEY}
)
with open("downloaded.pdf", "wb") as f:
    f.write(r.content)

创建分享链接(给其他 Agent)

# 生成 1 小时有效分享链接
r = requests.post(
    f"{BASE}/files/{file_id}/share",
    json={"expires_in": 3600},
    headers={"X-Agent-Key": API_KEY}
)
share_token = r.json()["share_token"]
share_url = f"https://api.traceclaw.cn/api/v1/files/shared/{share_token}"
print(f"分享链接: {share_url}")

# 对方无需认证即可下载
r = requests.get(share_url)
with open("shared_file.pdf", "wb") as f:
    f.write(r.content)

查看文件列表

r = requests.get(
    f"{BASE}/files",
    headers={"X-Agent-Key": API_KEY}
)
files = r.json()
for f in files:
    print(f"{f['filename']} — {f['file_size']} bytes")

查询 Agent 信息

r = requests.get(
    f"{BASE}/agents/me",
    headers={"X-Agent-Key": API_KEY}
)
print(r.json())
# {
#   "agent_id": "agt_xxx",
#   "name": "my-agent",
#   "total_storage_mb": 30,
#   "used_storage_mb": 1.2,
#   "subscription_end": null
# }

curl 一行命令版

# 注册
curl -s -X POST https://api.traceclaw.cn/api/v1/agents/register/open \
  -H "Content-Type: application/json" \
  -d '{"name":"my-agent"}'

# 上传文件
curl -s -X POST https://api.traceclaw.cn/api/v1/files/upload \
  -H "X-Agent-Key: avk_xxxxx" \
  -F "file=@myfile.pdf"

# 下载文件
curl -s -o output.pdf \
  https://api.traceclaw.cn/api/v1/files/download/{file_id} \
  -H "X-Agent-Key: avk_xxxxx"

# 创建分享链接
curl -s -X POST https://api.traceclaw.cn/api/v1/files/{file_id}/share \
  -H "X-Agent-Key: avk_xxxxx" \
  -H "Content-Type: application/json" \
  -d '{"expires_in": 3600}'

# 查看文件列表
curl -s https://api.traceclaw.cn/api/v1/files \
  -H "X-Agent-Key: avk_xxxxx" | jq .

Web 管理后台

注册后可通过浏览器管理文件:

登录后可查看存储使用量、管理上传的文件、查看 API Key。

套餐说明

AgentCloud 采用会员制:

套餐价格存储空间
🆓 免费¥030 MB
⭐ VIP¥6/月600 MB
💎 SVIP¥30/月3.2 GB
👑 SVIP+¥128/月15 GB

注册即送免费额度,可通过 Web 后台充值升级。

OpenClaw / OpenCode 用户使用

安装方式

OpenClaw/OpenCode 不支持 hermes skills install,但支持本地 skill 目录发现。有两种方式让 skill 生效:

方式一:直接克隆仓库用 CLI 脚本

git clone https://github.com/jiangzh0202/agentcloud-skill.git ~/agentcloud-skill
cd ~/agentcloud-skill
pip install requests
python3 scripts/agentcloud.py register
python3 scripts/agentcloud.py me

方式二:让 OpenClaw 自动发现 SKILL.md

# 全局安装(所有项目生效)
mkdir -p ~/.config/opencode/skills/agentcloud
cp ~/agentcloud-skill/SKILL.md ~/.config/opencode/skills/agentcloud/

# 或项目级安装(仅当前项目生效)
mkdir -p .opencode/skills/agentcloud
cp ~/agentcloud-skill/SKILL.md .opencode/skills/agentcloud/

OpenClaw/OpenCode 会自动从 ~/.config/opencode/skills/.opencode/skills/.claude/skills/.agents/skills/ 目录加载 skill。安装后 Agent 在对话中可自动发现并使用。

在代码中调用 API

# OpenClaw 脚本示例
import requests

# 注册(开放注册,无需任何前置条件)
r = requests.post("https://api.traceclaw.cn/api/v1/agents", json={
    "name": context.agent.name  # 使用 Agent 自身名称
})
config = r.json()
context.memory.set("agentcloud_key", config["api_key"])

# 上传文件
r = requests.post(
    "https://api.traceclaw.cn/api/v1/files/upload",
    files={"file": open("/tmp/result.txt", "rb")},
    headers={"X-Agent-Key": config["api_key"]}
)
file_id = r.json()["file_id"]

助手脚本

本技能附带了一个 Python 助手脚本 agentcloud.py,提供更便捷的接口:

# 一键注册
python3 agentcloud.py register

# 上传文件
python3 agentcloud.py upload myfile.pdf

# 下载文件
python3 agentcloud.py download <file_id> -o output.pdf

# 查看文件列表
python3 agentcloud.py list

# 分享文件
python3 agentcloud.py share <file_id> --expires 3600

详细用法见脚本文件。

注意事项

  1. API Key 安全avk_xxx 是 Agent 的唯一凭证,不要泄露
  2. 文件大小限制:单文件最大 500MB(Nginx 限制)
  3. 存储限制:免费用户 30MB,超出后上传会被拒绝
  4. 分享过期:分享链接默认 24 小时有效,可自定义过期时间
  5. 跨 Agent 传输:A Agent 创建分享链接 → B Agent 用链接下载,无需 B 有 API Key

服务状态

Comments

Loading comments...